Ignore every .env variant but the template

A file named .env.vercel or .env.production would have been committed by the
old two-line list, which is exactly the file someone reaches for when they need
somewhere to paste real credentials.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/.gitignore

@@ -1,6 +1,7 @@
 node_modules
 .next
-.env
+# Every .env variant is secret except the committed template.
-.env.local
+.env*
+!.env.example
 next-env.d.ts
 *.tsbuildinfo